VEXAIoT: Autonomous IoT Vulnerability Exploitation Using AI Agents (arXiv 2607.09653)

Summary

VEXAIoT is an autonomous multi-agent framework that combines LLM reasoning with offensive security tooling to discover and exploit vulnerabilities in IoT systems, which are often exposed due to hardware constraints, outdated firmware, and insecure configurations. The framework pairs a vulnerability detection agent with an attack execution agent that performs reconnaissance, plans attack sequences, and executes exploits end-to-end. The authors evaluate the system in the IoTGoat and Metasploitable environments across ten attack scenarios mapped to OWASP IoT vulnerabilities. Across 260 attack executions, VEXAIoT achieved an overall success rate of 95.0% (94.5% on IoTGoat and 96.7% on Metasploitable2), with most attacks completing in under two minutes on average. Published as arXiv:2607.09653 by Katherine Swinea, Kshitiz Aryal, Lopamudra Praharaj, and Maanak Gupta, the paper demonstrates how LLM-driven agents can automate offensive security testing for IoT devices and highlights the implications for defensive research and vulnerability assessment.